ServiceNow has released fixes for four serious security weaknesses affecting its Now Platform and AI platform, including three critical vulnerabilities that may be exploitable without authentication. The issues create paths to arbitrary code execution, unauthorized database activity, sensitive-data exposure and privilege escalation inside a platform that often sits at the center of enterprise operations.

The company disclosed the vulnerabilities in its August 2026 advisory and said they were identified through internal research and responsible disclosure. Customers covered by ServiceNow’s patching program have received relevant updates, but organizations running self-hosted deployments need to verify their versions and install the appropriate hotfixes promptly.

Three critical flaws affect the AI platform

Two of the critical bugs, CVE-2026-18885 and CVE-2026-18886, are code-injection vulnerabilities in the ServiceNow AI platform. Under certain conditions, an unauthenticated attacker could execute code or create and modify instance data outside the permissions the platform was meant to enforce. The second issue could also support privilege escalation, allowing an intruder to move beyond an initially limited level of access.

The third critical issue, CVE-2026-74820, is an SQL injection vulnerability. Successful exploitation could allow an unauthenticated attacker to submit arbitrary database commands to an affected instance. Depending on configuration and accessible data, that could expose confidential records, corrupt workflow information or alter database-backed content used by business processes.

These risks are amplified by ServiceNow’s role in large organizations. Instances can hold IT service tickets, security cases, employee requests, customer records, asset information and automation logic. They may also connect to identity systems and other internal services. A compromise therefore has the potential to affect far more than a single application.

Now Platform sandbox escape adds another route

ServiceNow also fixed CVE-2026-6876, a high-severity sandbox escape in the Now Platform. Sandboxes are intended to restrict what untrusted or limited code can do. Escaping that boundary can permit arbitrary code execution and access beyond the intended security context, turning a constrained function into a broader platform compromise.

The available fixes span several supported release families. ServiceNow identified patched builds including Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4, several Zurich updates beginning with Patch 7b Hot Fix 3, and Australia fixes from Patch 2 Hot Fix 3 onward. Administrators should use the vendor advisory to map their exact build to the correct update rather than assuming a major-version name alone confirms protection.

What defenders should do now

Security and platform teams should treat the critical AI-platform issues as urgent, particularly where an instance is self-hosted or exposed to untrusted networks. A disciplined response should include:

• Inventory every ServiceNow instance and confirm its precise patch and hotfix level.
• Apply the vendor-provided update or move to a later supported fixed release.
• Review administrative accounts, integrations and recent privilege changes.
• Look for unexpected record modifications, unusual database queries and unexplained code execution.
• Preserve relevant audit logs so suspicious activity can be investigated after patching.

Organizations should also assess the blast radius of a potential instance compromise. That means identifying connected systems, stored secrets and automated actions that a privileged ServiceNow account can trigger. Rotating exposed credentials may be warranted if telemetry suggests exploitation or if log coverage is insufficient to establish that the environment remained clean.

Platform owners should coordinate with incident responders before clearing logs or making broad configuration changes. Capturing authentication events, audit history and integration activity first can preserve evidence needed to distinguish routine administration from abuse. Teams should also verify that development and test instances are covered, since non-production systems may contain realistic data or trusted connections while receiving less monitoring.

There is no substitute for verifying the installed build. Because the flaws include unauthenticated attack paths and affect data integrity as well as confidentiality, delayed patching leaves a high-value enterprise control plane at risk.